Update README.md

Author: Michael Pratt

README.md

@@ -32,22 +32,60 @@ Then open a browser and navigate to http://localhost:9000. The port can be overr
 
 ## Running with Docker
 
-The following maven command will generate a Docker image:
+Note for Mac Users: You need to convert newline formatting of the kafdrop.sh file *before* running this command:
 
 ```
-    mvn clean package assembly:single docker:build
+    dos2unix src/main/docker/*
 ```
 
-Note for Mac Users: You need to convert newline formatting of the kafdrop.sh file *before* running this command:
+The following maven command will generate a Docker image:
 
 ```
-    dos2unix src/main/docker/*
+    mvn clean package assembly:single docker:build
 ```
 
+
 Once the build finishes you can launch the image as follows:
 
 ```
     docker run -d -p 9000:9000 -e ZOOKEEPER_CONNECT=<host:port,host:port> kafdrop
 ```
 
 And access the UI at http://localhost:9000.
+
+## Kafka APIs
+
+Starting with version 2.0.0, Kafdrop offers a set of Kafka APIs that mirror the existing HTML views. Any existing endpoint can be returned as JSON by simply setting the *Accept : application/json header*. There are also two endpoints that are JSON only:
+
+    /topic : Returns array of all topic names
+    /topic/{topicName}/{consumerId} : Return partition offset and lag details for a specific topic and consumer.
+
+## Swagger
+
+To help document the Kafka APIs, Swagger has been included. The Swagger output is available by default at the following Kafdrop URL:
+
+    /v2/api-docs
+    
+However this can be overridden with the following configuration:
+
+    springfox.documentation.swagger.v2.path=/new/swagger/path
+
+Currently only the JSON endpoints are included in the Swagger output; the HTML views and Spring Boot debug endpoints are excluded.
+
+You can disable Swagger output with the following configuration:
+
+    swagger.enabled=false
+
+## CORS Headers
+
+Starting in version 2.0.0, Kafdrop sets CORS headers for all endpoints. You can control the CORS header values with the following configurations:
+
+    cors.allowOrigins (default is *)
+    cors.allowMethods (default is GET,POST,PUT,DELETE)
+    cors.maxAge (default is 3600)
+    cors.allowCredentials (default is true)
+    cors.allowHeaders (default is Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization)
+    
+You can also disable CORS entirely with the following configuration:
+
+    cors.enabled=false